Improved Four-state Continuous-variable Quantum Key Distribution with Long Secure Distance 



Jian Yang, Bingjie Xu, Xiang PengEI and Hong GucQ 
CREAM Group, State Key Laboratory of Advanced Optical Communication Systems and Networks (Peking University), 
School of Electronics Engineering and Computer Science, Peking University, Beijing 100871, PR China 

(Dated: February 7, 2012) 

The four- state continuous- variable quantum key distribution (CVQKD) protocol has a long practical secure 
distance |1], while it has the difficulty of parameter estimation. We propose an improved four- state proto- 
col, where the covariance matrix can be estimated from experimental data without using the linear channel 
assumption, and thus ensuring its unconditional security in the asymptotical limit. Our new scheme keeps the 
advantages of high reconciliation efficiency and long secure distance of the four- state protocol, and it can be 
implemented under current technology. 
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I. INTRODUCTION 

Quantum key distribution (QKD) is one of the most prac- 
tical application of quantum information, which allows two 
remote parties, Alice and Bob, to establish a sequence of se- 
cure keys 1 2]. Continuous-variable quantum key distribution 
(CVQKD) encodes information into the quadratures x and p 
of the optical field, and extracts it with homodyne detections, 
which usually have higher repetition rate than that of single- 
photon detections. So, CVQKD can potentially generate se- 
cure keys with higher speed. Historically, CVQKD protocols 
are at first based on squeezed states (31 IJ] . Later, coherent 
state protocols with Gaussian modulation were found to be 
more practical choices 11,0]. Both protocols have been ex- 
perimentally demonstrated |/, 8] and have been shown secure 
against arbitrary collective attacks LS, JO], which are optimal 
in the asymptotical limit lITlll . 

One remaining problem is that the reconciliation efficiency 
13 is quite low for Gaussian modulation, especially when the 
transmission distance is long. As mentioned in 1 1], this is the 
main limiting factor of the secure distance. There are two pos- 
sible ways to solve this problem. One is to build a good rec- 
onciliation code with reasonable efficiency even at low SNR 
(signal to noise ration), which has been achieved very recently 
III2I1 . The other is to use discrete modulation, such as the four- 
state protocol, proposed by Leverrier et ah 1 1]. In this proto- 
col, Alice randomly prepares one of the four coherent states: 
\(Xm)B = W^^'^^^^''I^)b with m G {0, 1, 2, 3} and sends to Bob. 
Then, Bob randomly measures the x ov p quadrature of the 
signal pulse as his result, the sign of which encodes the bit of 
the raw key. Since the sign of quadrature has discrete possi- 
ble values, there exist very good error correction codes when 
extracting I {a : b), even for extremely low SNR. From this 
viewpoint, the four- state protocol combines the high reconcil- 
iation efficiency of discrete modulation and the security proof 
of CVQKD together, and improves the secure distance effec- 
tively. 

However, in this scheme, Alice and Bob can not estimate 
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the covariance matrix from their experimental data without 
the linear channel assumption (LCA) in practice. In the 
entanglement-based (E-B) scheme of the four-state protocol, 
the projection measurement {|<Am)(<Aml, ^ = 0, 1,2,3} Alice 
performs only helps to discriminate which coherent state is 
sent to Bob, but does not measure the quadratures of her mode. 
So, Alice and Bob are not able to evaluate the covariance ma- 
trix Jab from experimental data unless using the LCA, which 
compromises the security of the protocol. To solve this prob- 
lem, Leverrier et al. modified their protocols by introducing 
decoy states 1 13], such that 

/^Pkey + (1 - P)Pd&coy = PG, (1) 

where pkey is the state sent to Bob in the four- state protocol 
and Pdecoy is the decoy state. Alice randomly prepares pkey 
and Pdecoy with probability p and l-p, respectively, so that the 
mixed state sent to Bob is Gaussian, pc. The main difficulty 
of this method is the decoy state Pdecoy can not be accurately 
prepared. 

In this paper, we proposed an improved four-state proto- 
col by modifying its entanglement-based (E-B) scheme, the 
covariance matrix of which can be directly evaluated from ex- 
perimental data without using the LCA, and its corresponding 
prepare and measurement (P&M) scheme is not difficult to im- 
plemented under current technology. Using discrete coding, 
the high reconciliation efficiency and long secure distance can 
be kept in this protocol. 

II. THE IMPROVED ENTANGLEMENT-BASED SCHEME 
OF THE ORIGINAL FOUR-STATE PROTOCOL 

In this section, we introduce the improved E-B scheme of 
the original four-state protocol. In practice, CVQKD proto- 
cols are implemented in the P&M scheme, and the secure key 
rate against collective attacks can be calculated by 

Kr =fil(a :b)-S(b: E), (2) 

where Kr is the secure key rate using reverse reconciliation, 
I(a : b) is the classical mutual information between Alice 
and Bob, S(b : E) is the quantum mutual information be- 
tween Bob and Eve, and JS is the reconciliation efficiency. 
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FIG. 1: (color online) Preliminary model for improving the E-B 
scheme. Alice prepares mixed states pab, measures x and p of her 
mode, and sends the other to Bob. Then, Bob measures the quadra- 
tures of his mode with homodyne detection. Though this model can 
not generate secure keys directly, it is very enlightening. 

I{a : b) can be directly estimated from experimental data, 
while S{h : E) should be estimated using its equivalent E- 
B scheme. In the E-B scheme of original four- state protocol 
iH], Alice prepares 

\^l)aB = -^l<Am)A|0^m)fi, (3) 

m-0 

measures mode A with {\i//m}A{^m\}, and sends mode 5 to Bob, 
where {|jAm)A} are orthogonal states and m e {0, 1,2,3}. As 
mentioned above, the main difficulty of this E-B scheme is 
parameter estimation, where Alice's measurement {|<Am)(<Am|} 
only helps her to discriminate which state is sent to Bob, but 
does not provide any information about the quadratures of her 
mode. Comparatively, in the E-B scheme of Gaussian modu- 
lation protocols L14], Alice prepares EPR pairs, and measures 
her mode with heterodyne detection, which not only projects 
Bob's mode into coherent states, but also provides the infor- 
mation about the quadratures of Alice's mode, with which Al- 
ice and Bob are able to estimate the co variance matrix jab 
from their experimental data. 

Our improvement is to substitute {|<Am)A} with proper states 
{I^Am)^}- Obviously, there are at least two conditions that 
\^ }ab = l]li^o^m\i/^m)A\(^m}B should satisfy, where Cm is the 
normalization coefficient: 

1. Alice's mode {|<AJ„)a} can be discriminated by homo- 
dyne or heterodyne detections, with which Alice are 
able to measure the quadratures of mode A and the co- 
variance matrix jab can be estimated from experimental 
data. 

2. The covariance matrix of |0') should be as close to that 
of Gaussian state as possible, which ensures the secure 
bound is tight, since the Gaussian optimality theorem is 
used when calculating 5" (Z? : E). 

From this viewpoint, the original E-B model in Eq. (3) satis- 
fies condition 2, since its covariance matrix is close to that of 
EPR state, especially when the modulation is small. Its main 
drawback is that Alice does not use homodyne or heterodyne 
detections, which does not satisfies condition 1. 

A natural choice for is coherent states, = {jSm) = 
^^i(2m+i)7:/4y^ whcrc JS is real and m = 0, 1, 2, 3. When JS is 
large, states {\Pm}} can be discriminated by heterodyne detec- 
tion approximately. However, in this case, Alice's measure- 
ment projects Bob's state into a superposition of coherent 



states, which is diff'erent from the of the original four- state 
protocol, and its equivalent P&M scheme is difficult to imple- 
ment in real experiment. 

A. The Mixed-state Scheme 

To avoid the problems above, we consider that Alice pre- 
pares mixed state pab and measures x and p of mode A simul- 
taneously with heterodyne detection, where 

PAB = - ^ \Pm)A{Pm\ ® km)fi<0^m|. (4) 

As illustrated in Fig. 1, Alice projects mode B into a classical 
mixture of coherent states, which can be implemented in its 
P&M counterpart. Then, Bob randomly measures x ox p of 
mode B with homodyne detection to extract the information. 
In this scheme, pe is identical to that of original four- state 
protocol in Eq. (3) Jll]. To calculate Sib : E), we recall that 
the covariance matrix jab of Pab is defined by 

{yAB)ij = TrlpABiiri - di\ (rj - dj)}l (5) 

where the elements of displacement vector di and dj are in 
this scheme. Without difficult calculation, we find the covari- 
ance matrix of pab has the form that 

/ VaI CabI\ ... 
[cabI VbI j' 

where Va and Vb are the variances of mode A and B, and Cab 
are their correlations. After channel transmission, the covari- 
ance matrix is changed to 

VaI ^plCABl \ 
^CabI r](VB+x)^ /' 

where rj and;^ = (1 -7/)///+ 6 are the channel parameters. Both 
parameters can be estimated from experimental data. Here, 
for the ease of theoretical research, we suppose the channel 
is linear, and 7/ and e are the transmittance and excess noise, 
respectively. It should be emphasized that this assumption is 
just for simplifying the simulation, but not necessary in this 
scheme 1 15]. 

The classical mutual information I(a : b) can be calcu- 
lated by 1 - H(e), where e is the bit error rate and H(e) is 
the Shannon entropy. The calculation of S(b : E) is a little 
more complex. To maximize Eve's information. Eve is sup- 
posed to purify the whole system pab and the quantum mutual 
information S(b \ E) is calculated by 

S(b: E) = S(E)-S (E\b) = S (AB) - S (A\b), (8) 

where S(AB) and S(A\b) can be derived from jab, using the 
Gaussian optimality theorem |[l6l [T7h. 

It is not surprising that we can not acquire positive secure 
key rate Kr with this E-B scheme, and there are two reasons. 
First, when calculating S(b : E), we suppose Eve is able to 



3 




i Heterodyne 



Alice 



HomodYne 



FIG. 2: (color online) The improved entanglement-based scheme. 
Alice prepares pure states \^)fgab^ measures x and p of mode A with 
homodyne detections and sends mode B to Bob. 



purify the whole system to maximize the information leaked 
to her. So, this scheme just overestimates Eve's information, 
since pab is initially in a mixed state, and it is not difficult to 
find that S(b : E) > 0, even if the transmittance 77 is 1 . Sec- 
ond, the secure key rate in E-B scheme is related to how much 
pure entangled pairs can be extracted from pab, while in this 
E-B scheme, pab is separable and contains little entanglement. 
Though Alice and Bob are classically correlated, they can not 
distill secret information from experimental data. Neverthe- 
less, this attempt is very enlightening for our improved E-B 
scheme in the following. 



B. The Improved Entanglement-based Scheme 

In this subsection, we proposed our improved E-B scheme, 
which is illustrated in Fig. 2. Instead of mixed state pab, Alice 
prepares four-mode pure state \^i}fgab, where / denotes the 
improved E-B scheme and its subsystem AB is identical to the 
mixed state pab in Eq. (4), where 

Tr^G{|^/)FGA5<^/|}=PA5. 

The reason why we introduce two ancilla modes FG is to 
guarantee that the pure state \^i}fgab does exist. In this 
scheme, modes F and G are used as neutral parties, the in- 
formation of which is controlled neither by Eve nor by Alice 
and Bob. Alice measures x and p of mode A simultaneously 
with heterodyne detection, and then sends mode B to Bob. It 
is not difficult to verify that in this case is identical to that 
of the original four-state protocol. The classical mutual infor- 
mation I (a : b) can be directly calculated by 1 - H(e), while 
Eve's knowledge about Bob's data S(b : E) depends on the 
covariance matrix of \^i}fgab- Certainly, we can derive the 
exact expression of \^i}fgab and calculate its covariance ma- 
trix, while using our previous technique 1 15], we find that this 
work is not necessary. 

To compute S(b : £), we consider a pure state 



I^l)fga5 = \0)f\0)g\^l)ab. 



(9) 



where |0) is the vacuum state and \^l}ab is Leverrier's E-B 
model in Eq. (3). It is not difficult to verify the covariance 
matrix of \^l}fgab can be written as 
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FIG. 3: (color online) The secure key rate of improved E- 
B scheme. The lines from bottom to top correspond to 6 = 
0.002, 0.004, 0.006, 0.008 and 0.01, respectively. 



where Z is the correlation between Alice and Bob's quadra- 
tures As shown in (l^ , since \^i}ab and \^l}ab are dif- 
ferent purifications of pg, there exist a unitary transformation 
U FGA on mode F, G, and A, that 



l^/)FGAfi = UFGA\'i'L)FGAB, 



(11) 



which does not change the mutual information S(b : E), since 
Ufga is commuted with Ube, where Ube denotes Eve's oper- 
ation on mode B and E. So, we can safely calculate S(b : E) 
by substituting \^i}fgab with \^l}fgab, the elements of which 
are known. This result can also be understood physically. In 
reverse reconciliation. Both Alice and Eve performs error cor- 
rection according to Bob's data. Whenever |^/) or is 
used, the mode B sent to Bob is in the same state pg. Since 
Eve is not able to discriminate which E-B source is used, she 
has to perform the same strategy to eavesdrop the information, 
and the leaked information S(b : E) should be same. 
Since \^l}fgab is a pure state, we have 



S(E:b) = S(E)-S(E\b) 

= S(FGAB)-S(FGA\b) 
= S(AB)-S(A\b\ 



(12) 



where van Neumann entropies S(AB) and S(A\b) can be cal- 
culated with the symplectic eigenvalues of covariance matri- 
ces yAfi andy^ |18]. 

The performance of our improved E-B scheme is illustrated 
in Fig. 3, where we use a = 0.5 and j3 = 20. For small a, 
the CM of |Ol) is close to that of EPR state, which ensures 
a high secure key rate. For large JS, coherent states {jSm) are 
approximately orthogonal to each other, which are easier to 
be discriminated by heterodyne detection. The variance of ex- 
cess noise is set to be 0.002, 0.004, 0.006, 0.008 and 0.01, 
respectively. The secure distance is a little shorter than that of 
original four-state scheme, and this is mainly because coher- 
ent states {\l3m}} can not be discriminated deterministically. 

The reason why Pa^'s purification \^i}fgab can be used to 
generate secure keys is based on two sides. 
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First, \^i)fgab is a pure state, and Eve is not benefit from 
her purification at the very beginning. It is not difficult to ver- 
ify that S (b \ E) = 0, when t] = I. Second, though pab con- 
tains Httle entanglement, the whole system FGAB is generally 
an entangled-state, which can be used to extract secure keys. 
From this viewpoint, our improved E-B scheme just combines 
PAfi's advantages in parameter estimation and |Ol)'s advan- 
tages in computing S(b : E) together, which ensures a long 
secure distance. 



III. THE PREPARE AND MEASUREMENT SCHEME 

Though the E-B scheme is convenient for theoretical re- 
search, it is difficult to implement directly. In this section, 
we will present its equivalent P&M scheme. As mentioned 
above, in the E-B scheme, Alice measures quadratures x and 
p of mode A simultaneously. To do this, Alice should use a 
50 : 50 beamsplitter to separate mode A into two parts, Ai and 
A2, and the whole state is changed to 

3 

PA,MB = lS]\^)M{^m^}A2{^ma,„)s{aJ. (13) 
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FIG. 4: (color online) The TRNG based scheme of improved four 
state protocol. Alice generates random numbers Xa and Pa with 
TRNGl, and calculates {C,^^'^^^}, based on which Alice randomly 
prepares \am)B to generates Pb\xa,pa- extracts the information by 
randomly measuring x or p of mode B with homodyne detection. 




m-0 



Then, Alice measures x of mode Ai, measures p of mode A2, 
and projects Bob's state to 



PBI 



<{xa,Pa) 



\0^m){0^m 



(14) 



The coefficient C^"^'^"^^ is calculated by 



FIG. 5: (color online) The Beamsplitter based scheme of improved 
four state protocol. Alice modulates coherent state with a phase mod- 
ulator driven by TRNG2 with m - 0, 1, 2, 3, and 4, and separates it 
into two parts with a beamsplitter. Alice measures the quadratures x 
and p of one output state and sends the other to Bob. 



respectively, where density operators pA^ = tVA2B(PAiA2B) and 
PA2 = tVA,B(pAiA2B)- To prepare pfiUA,/?A' Alice randomly pre- 
pares a coherent state \am}B from ^ = 0, 1, 2, 3} with 
probability C^^'^"^^ and sends it to Bob. As illustrated in Fig. 
4, the TRNG-based scheme can be realized within current 
technology, while it is still a little complicated, since each 
time two random numbers are generated and the probability 



C^'^^^ = tr(MA,(pA)MA,(xA)pA,A,(m)MUxA)M^ (Pa)), {d'"'^"^} depends on the random pair (xa^Pa)- 



A2 

where operators Ma,(xa) = \xa}a,{^aI Ma2(Pa) = \Pa}a2{PaI 
andpAiA2(^) = I^)ai<^I ^ I^)a2<^|. This is a classical 
mixture of coherent states {lo^mX^^^ml}, where the probability 
^Ua,/?a) ^ Gaussian function of Alice's measurement result 
(xa,Pa)' The calculation of C^^'^^^ is straight with the meth- 
ods in ||2Q|i . while we omit the detail here and and focus on 
its experimental realization. In this section, we propose two 
possible P&M schemes to implement this protocol. One is the 
true random number generator (TRNG) based scheme and the 
other is the beamsplitter based scheme. 



A. TRNG based Scheme 

In TRNG-based scheme, each time Alice uses TRNGl to 
generate random pairs (xa, Pa) with probability 

Fr(xA) = tr(MA,(xA)pMMl^(xA)) 

and 

Fr(pA) = tr(MA2(PA)pA2Ml^(pA)\ 



B. Beamsplitter based Scheme 

To simplify the experimental implementation, we pro- 
pose a beamsplitter-based scheme. Noticing that pab = 
i ZLo \Pm)A(fim\ <S) \am)B{aml wc find it Can be directly im- 
plemented with a beamsplitter. As illustrated in Fig. 5, Alice 
prepares a coherent state and modulates it with a phase 
modulator, driven by TRNG2. Then, the modulated coher- 
ent state is separated by a beamsplitter, the output states of 
which are \Pm}A and \am}B, respectively. Then Alice measures 
the X and p of mode A simultaneously, and sends mode B to 
Bob. In this scheme, TRNG2 generates only 4 possible values 
{m = 0, 1, 2, 3}, which are easier to implement than TRNGl 
in Fig. 4. 



IV. DISCUSSION AND CONCLUSION 

To sum up, we propose an improved long-distance CVQKD 
protocol by modifying the E-B scheme. We find that the 
mixed state pab is helpful to establish a classical correlation 
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between Alice and Bob, and then purifies pab with two an- 
cilla mode F and G as the improved E-B model, \^i)fgaB' 
The parameter estimation can be performed in this scheme 
without using the LNA. Further, based on [15], we find the 
mutual information S(b : E) of our improved scheme is iden- 
tical to that of Leverrier's one, so we can derive a security 
bound for reverse reconciliation, without deriving the exact 
expression of the ancilla states F and G. From this viewpoint, 
our improved E-B scheme combines the high reconciliation 
efficiency of discrete coding and the facility of parameter es- 
timation together, and hence ensures a long secure distance 
with unconditional security. Also, we present two potential 
equivalent P&M schemes to implement the improved proto- 
col experimentally. 



There are also several remaining problems to study. First, 
the E-B model \^i}fgab can be further optimized to make its 
density matrix closer to that of a EPR, which may further im- 
prove the secure key rate. Second, in four-state protocol, the 
optimal value of a is less than 1, which is still not easy to 
detect by homodyne detections in the experiment. At last, its 
unconditional security against coherent attack need to be re- 
considered when the finite size eff'ect is taken into account. 
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